CVE-2026-25133
Stored XSS in October CMS SVG Upload Enables Privilege Escalation
Publication date: 2026-04-14
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| octobercms | october | to 3.7.13 (inc) |
| octobercms | october | From 4.0.0 (inc) to 4.1.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the October CMS platform versions prior to 3.7.14 and 4.1.10. It is a stored cross-site scripting (XSS) issue related to the SVG sanitization logic. The system uses a regex pattern to remove event handler attributes like onclick or onload from SVG files, but this pattern can be bypassed with a specially crafted payload. This allows malicious SVG files containing embedded JavaScript to be uploaded via the Media Manager.
For the exploit to succeed, an attacker must have authenticated backend access with media upload permissions. The malicious SVG must then be viewed or embedded in a page by a superuser, which can lead to privilege escalation.
The issue was fixed in versions 3.7.14 and 4.1.10 of October CMS.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with authenticated backend access and media upload permissions to upload malicious SVG files containing JavaScript. When a superuser views or embeds these SVG files, the embedded script can execute, potentially leading to privilege escalation.
This means an attacker could gain higher privileges than intended, possibly compromising the security and integrity of the CMS and its data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade October CMS to version 3.7.14 or 4.1.10 or later, where the stored cross-site scripting (XSS) issue in the SVG sanitization logic has been fixed.
Additionally, restrict authenticated backend access with media upload permissions to trusted users only, as exploitation requires such access.
Avoid viewing or embedding untrusted SVG files in pages until the system is updated.